CVE-2014-0114 Arbitrary code execution in Apache Commons BeanUtils

High 7.5 Published 30 Apr 2014 Updated 14 Oct 2026

Remote attackers can execute arbitrary code by manipulating the ClassLoader via the class parameter in Apache Commons BeanUtils.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0114?

CVE-2014-0114 is a high-severity code injection vulnerability in Apache Struts, published on 30 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Weakness: CWE-20

Which versions are affected by CVE-2014-0114?

2 open source packages ship an affected version, including commons-beanutils:commons-beanutils. It affects 2 products.

Package	Affected	Fixed in
`commons-beanutils:commons-beanutils` Maven	From `1.8.0`	`1.9.4`
`commons-beanutils:commons-beanutils` Maven	From `1.8.0`	`1.9.4`

Linux distribution packages (25)

`struts` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-javadoc` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-manual` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-webapps-tomcat5` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-javadoc` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-manual` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts-webapps-tomcat5` Red Hat:enterprise_linux:5::server	All versions	`0:1.2.9-4jpp.8.el5_10`
`struts` Red Hat:network_satellite:5.4::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-core` Red Hat:network_satellite:5.4::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-extras` Red Hat:network_satellite:5.4::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-taglib` Red Hat:network_satellite:5.4::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-tiles` Red Hat:network_satellite:5.4::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts` Red Hat:network_satellite:5.5::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-core` Red Hat:network_satellite:5.5::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-extras` Red Hat:network_satellite:5.5::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-taglib` Red Hat:network_satellite:5.5::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-tiles` Red Hat:network_satellite:5.5::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts` Red Hat:network_satellite:5.6::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-core` Red Hat:network_satellite:5.6::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-extras` Red Hat:network_satellite:5.6::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-taglib` Red Hat:network_satellite:5.6::el6	All versions	`0:1.3.10-6.ep5.el6`
`struts-tiles` Red Hat:network_satellite:5.6::el6	All versions	`0:1.3.10-6.ep5.el6`

Products include Apache Commons Beanutils, Apache Struts.

How do I fix CVE-2014-0114?

Upgrade commons-beanutils:commons-beanutils to 1.9.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2014-0114 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0114 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 3 proofs of concept on GitHub.

All Apache Struts vulnerabilities

Sources

Also known as CLSA-2026-1779756520, CLSA-2026-1788757862, CLSA-2026-1792010669, CLSA-2026-1793128163, CVE-2014-3540, CVE-2014-3893 and 10 more.